ClawHub
Back to skill

Security audit

swanlog

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed read-only SwanLab log exporter, but it uses your existing SwanLab login and saves potentially sensitive run details locally.

Install this only if you want Codex or Claude to use your existing SwanLab login to fetch experiment data. Treat the generated swanlog directory as potentially sensitive, especially config.yaml, metadata.json, requirements.txt, and metrics.csv, and avoid sharing it publicly without review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

md
Given an experiment ID (or `--latest`), the skill:

1. Authenticates against SwanLab using your local `~/.swanlab/.netrc` credentials.
2. Pulls the experiment's `metrics` (as a tidy `metrics.csv`), the resolved `config.yaml`, the captured `metadata.json`, and a `requirements.txt` snapshot.
3. Saves everything under `./swanlog_<YYYY-MM-DD_HH-MM-SS>/`, named by `run.created_at` so the directory is **stable across re-fetches** of the same run (idempotent).
4. Returns a one-screen brief: run name / state / URL / latest train & val loss.

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md
Given an experiment ID (or `--latest`), the skill:

1. Authenticates against SwanLab using your local `~/.swanlab/.netrc` credentials.
2. Pulls the experiment's `metrics` (as a tidy `metrics.csv`), the resolved `config.yaml`, the captured `metadata.json`, and a `requirements.txt` snapshot.
3. Saves everything under `./swanlog_<YYYY-MM-DD_HH-MM-SS>/`, named by `run.created_at` so the directory is **stable across re-fetches** of the same run (idempotent).
4. Returns a one-screen brief: run name / state / URL / latest train & val loss.

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
Given an experiment ID (or `--latest`), the skill:

1. Authenticates against SwanLab using your local `~/.swanlab/.netrc` credentials.
2. Pulls the experiment's `metrics` (as a tidy `metrics.csv`), the resolved `config.yaml`, the captured `metadata.json`, and a `requirements.txt` snapshot.
3. Saves everything under `./swanlog_<YYYY-MM-DD_HH-MM-SS>/`, named by `run.created_at` so the directory is **stable across re-fetches** of the same run (idempotent).
4. Returns a one-screen brief: run name / state / URL / latest train & val loss.

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 34)May include surrounding context.

md
Given an experiment ID (or `--latest`), the skill:

1. Authenticates against SwanLab using your local `~/.swanlab/.netrc` credentials.
2. Pulls the experiment's `metrics` (as a tidy `metrics.csv`), the resolved `config.yaml`, the captured `metadata.json`, and a `requirements.txt` snapshot.
3. Saves everything under `./swanlog_<YYYY-MM-DD_HH-MM-SS>/`, named by `run.created_at` so the directory is **stable across re-fetches** of the same run (idempotent).
4. Returns a one-screen brief: run name / state / URL / latest train & val loss.

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_swanlog.py (reported line 27)May include surrounding context.

python
Given an experiment ID (or `--latest`), the skill:

1. Authenticates against SwanLab using your local `~/.swanlab/.netrc` credentials.
2. Pulls the experiment's `metrics` (as a tidy `metrics.csv`), the resolved `config.yaml`, the captured `metadata.json`, and a `requirements.txt` snapshot.
3. Saves everything under `./swanlog_<YYYY-MM-DD_HH-MM-SS>/`, named by `run.created_at` so the directory is **stable across re-fetches** of the same run (idempotent).
4. Returns a one-screen brief: run name / state / URL / latest train & val loss.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This describes the skill authenticating by automatically using local credentials stored in ~/.swanlab/.netrc. Even if intended for convenience, automatic credential access is high risk in an agent skill because a mis-trigger, prompt injection, or ambiguous request could cause the agent to act with the user's stored cloud permissions and retrieve sensitive run data without an explicit re-authentication step.

Content

Scanner excerpt · README.zh-CN.md (reported line 11)May include surrounding context.

md
给定一个实验 ID（或 `--latest`），这个 skill 会：

1. 通过本地 `~/.swanlab/.netrc` 凭据登录 SwanLab。
2. 拉取实验的 `metrics`（整理成 `metrics.csv`）、解析后的 `config.yaml`、`metadata.json` 快照，以及 `requirements.txt`。
3. 全部保存到 `./swanlog_<YYYY-MM-DD_HH-MM-SS>/`，命名使用 `run.created_at` —— 因此对同一个 run 重复拉取**目录名稳定**（幂等）。
4. 返回一屏简报：run 名称 / 状态 / URL / 最新 train & val loss。

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documentation explicitly says the skill will 'automatically read' credentials from ~/.swanlab/.netrc with no extra configuration. In an agent environment, this lowers the barrier for silent privilege use: any accidental or maliciously induced invocation can immediately leverage stored secrets to access remote experiment data, which may include metadata, configs, and dependency snapshots containing sensitive information.

Content

Scanner excerpt · README.zh-CN.md (reported line 26)May include surrounding context.

md
之后在任意 Claude Code 会话里，让 Claude "拉一下 swanlab" / "pull the latest swanlab run" 等，skill 会自动触发。

> **认证**：只要你在终端执行过一次 `swanlab login`，凭据就会缓存在 `~/.swanlab/.netrc` 里 —— skill 会自动读取，无需额外配置。

### 作为独立 CLI

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README promotes downloading config, metadata, requirements, and run info but does not warn that these artifacts can contain sensitive information such as internal paths, hostnames, git SHAs, package inventories, or embedded secrets in configs. Users may share or analyze the exported directory with agents or third parties without realizing the privacy and security implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly encourages aggressive automatic triggering for broad natural-language requests, which increases the chance the skill runs in contexts the user did not clearly intend. Because the skill accesses local SwanLab credentials and downloads potentially sensitive experiment data to disk, overbroad activation meaningfully raises the risk of unintended credential-backed actions and data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is documented to trigger aggressively on broad natural-language phrases like '拉一下 swanlab' and '看下最新实验', which can overlap with ordinary conversation and cause the agent to invoke the skill unintentionally. In this skill's context, mis-triggering can immediately lead to network access and local credential use, so the broad trigger surface materially increases the chance of unintended data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that the skill will automatically read credentials from ~/.swanlab/.netrc without requiring extra configuration, but it does not prominently warn users that invoking the skill causes credential-backed remote access. This is dangerous because users may believe they are performing a simple read-side analysis while the agent is actually using stored secrets and pulling potentially sensitive experiment data to local disk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to execute a local Python script, capture stdout/stderr, and read generated files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That means the runtime may grant broader-than-necessary file and environment access, increasing the blast radius if the script or surrounding skill content is modified, compromised, or misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script intentionally downloads and writes experiment config, metadata, requirements, and run info to local disk in one shot. Those artifacts can contain secrets, internal hostnames, repository details, environment information, or other sensitive operational data, and the tool defaults to broad collection without an explicit warning, minimization option, or protective file-permission handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency on swanlab is only lower-bounded and not pinned to a specific version, which makes builds non-reproducible and allows future installs to pull in unexpected or compromised releases. In a skill that pulls remote experiment data from a cloud service, dependency drift increases supply-chain risk because the package is directly involved in network access and local file handling.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
swanlab>=0.7.15
pandas>=2.0
omegaconf>=2.3

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The pandas dependency is unpinned, so installations may resolve to different versions over time, including releases with security defects or breaking behavior. Because this skill downloads cloud experiment artifacts for local inspection, insecure or unexpected parsing behavior in a data-processing library can expand the attack surface when handling untrusted experiment data.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
swanlab>=0.7.15
pandas>=2.0
omegaconf>=2.3

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The omegaconf package is specified with a minimum version only, which permits uncontrolled upgrades and weakens reproducibility. Since this skill retrieves configs and metadata from a remote source, dependency drift in a configuration-parsing library can introduce parsing or deserialization risks if a problematic upstream version is installed.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
swanlab>=0.7.15
pandas>=2.0
omegaconf>=2.3

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The requirements note that the user must be logged in and that credentials reside in ~/.swanlab/.netrc, and the code then initializes the API using that local authentication context. The file mentions the credential location but does not warn users to protect or avoid exposing that credential store, which is a safety-relevant detail when handling local auth material.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/fetch_swanlog.py (reported line 291)May include surrounding context.

python
return None
        if isinstance(profile, dict):
            return profile.get(key)
        return getattr(profile, key, None)

    written: list[str] = []
    if config := _get("config"):

Static analysis

No suspicious patterns detected.